Lack of a code of conduct in the health care system and the protection of patient’s personal data

Abstract

The Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR) shall concern all those who process personal data of natural persons with regard to their professional, commercial and statutory activities. It was addressed to many industries, and as it is well known each industry is different, running an online store cannot be compared with the provision of health care or treatment. The Member States, the supervisory authorities, the European Data Protection Board and the Commission shall encourage the drawing up of codes of conduct intended to contribute to the proper application of this Regulation. The code of conduct is to provide the minimum requirements related to the protection of personal data in health care facilities that must be met in order to demonstrate compliance with the GDPR. The purpose of the code is, inter alia, the collection of the personal data, fulfilling the obligation to inform and the use of technical means to prevent personal data breach. Almost four years have passed since the application of the GDPR regulations and no code of conduct has been adopted for application, including the health protection. The GDPR applied without proper interpretation would make it impossible to conduct medical treatment which involve sensitive data processing. In the current legal situation is a patient provided with adequate protection?